Deprecated

Removed from AWS on 2021-04-02 - Active for 6 years

AmazonMachineLearningRoleforRedshiftDataSource

Last Modified

Feb 10, 2019

February 10, 2019 at 06:13 PM UTC

Version

v1

Total Versions

1

Created

Apr 9, 2015

Actions

16

Subscribe to updates

Risk

Medium

The same capabilities in a scoped form, resource policy writes, reads across all data, or full access to a whole service. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed

  • Medium

    Can rewrite resource policies and sharing

    Grants 1 permissions management action across 1 service (s3) on any resource, enough to share resources outside the account.

    s3:putbucketpolicy

    Use with caution: Turn on IAM Access Analyzer external access findings, and keep account-level guards like S3 Block Public Access enabled.

  • Medium

    Can read data in every bucket or table

    Reads any object in any S3 bucket. Read-only is not the same as harmless when the data is the asset.

    s3:GetObject

    Use with caution: Read access to data is still access to data. For people who only need to see configuration, ViewOnlyAccess carries none of these signals.

Policy Document

View on GitHub
{
  "PolicyVersion": {
    "CreateDate": "2015-04-09T17:05:26Z",
    "VersionId": "v1",
    "Document": {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Action": [
            "ec2:AuthorizeSecurityGroupIngress",
            "ec2:CreateSecurityGroup",
            "ec2:DescribeInternetGateways",
            "ec2:DescribeSecurityGroups",
            "ec2:RevokeSecurityGroupIngress",
            "redshift:AuthorizeClusterSecurityGroupIngress",
            "redshift:CreateClusterSecurityGroup",
            "redshift:DescribeClusters",
            "redshift:DescribeClusterSecurityGroups",
            "redshift:ModifyCluster",
            "redshift:RevokeClusterSecurityGroupIngress",
            "s3:GetBucketLocation",
            "s3:GetBucketPolicy",
            "s3:GetObject",
            "s3:PutBucketPolicy",
            "s3:PutObject"
          ],
          "Resource": "*",
          "Effect": "Allow"
        }
      ]
    },
    "IsDefaultVersion": true
  }
}

Version History (1 recorded)

Raw history

First commit

No recorded action delta - this version predates the change index. View the raw diff.

Feb 10, 2019

ad4c2e8